Connected Devices Can Create Cybersecurity Risk

When most business owners think about cybersecurity, they probably think about computers.

Laptops.

Servers.

Email.

Maybe their Microsoft 365 environment.

They probably don't think about the freezer.

But hundreds of businesses in France recently learned why they should.

In October, hackers compromised refrigeration controllers at approximately 700 commercial sites across France. According to France's Centre for Cyber Crisis Coordination, attackers changed defrost settings to high temperatures, resulting in significant merchandise losses and at least 15 fires.

The attack was unusual.

The security problem behind it isn't.

More of the equipment businesses rely on every day is connected to networks and the internet.

And every connected device creates another question:

Who can access it?

Not Everything Connected to Your Network Looks Like IT

Walk through almost any modern business and you'll find technology that doesn't necessarily look like technology.

Security cameras.

Door-access systems.

Thermostats.

Printers.

Conference-room equipment.

Manufacturing equipment.

Medical devices.

Building controls.

Refrigeration systems.

Many of these devices can communicate over a network, connect to cloud services, or allow a vendor to access them remotely.

That connectivity can be incredibly useful.

A refrigeration company can monitor equipment without sending someone onsite.

A building manager can adjust HVAC systems remotely.

A security company can manage cameras and access controls from another location.

But convenience and connectivity also create something businesses need to understand:

Another potential way into a system.

The Equipment Nobody Thinks About Can Become the Weakness

One of the most important details in the French attack wasn't simply that refrigeration equipment was connected to the internet.

It was the condition of some of the technology controlling it.

Danfoss, whose refrigeration technology was involved in the initial attack, told Le Monde that many of the affected units were obsolete products that had reached end of life and were no longer receiving software or security updates.

That's a problem that extends far beyond refrigeration.

Businesses often replace laptops every few years.

Servers get upgraded.

Operating systems eventually get retired.

But other connected equipment can remain in place for much longer.

A camera system might work perfectly well for eight years.

A door-access controller might keep functioning for a decade.

A piece of manufacturing equipment might last even longer.

From an operational perspective, there's an understandable attitude:

If it still works, why replace it?

From a cybersecurity perspective, there's another question:

Is it still supported and secure?

A device doesn't stop becoming part of your technology environment simply because nobody thinks of it as a computer.

Do You Know Who Has Remote Access?

There's another part of this story businesses should pay attention to.

Equipment like refrigeration, HVAC, security, and building controls is often installed and maintained by outside vendors.

That's normal.

But it can create a visibility problem.

Your IT team may know who has access to Microsoft 365.

They may know who can connect to your servers.

They may know which employees have administrative privileges.

But does anyone know who can remotely access the building controls?

The cameras?

The alarm system?

The manufacturing equipment?

The refrigeration system?

And when a vendor relationship ends, does someone make sure that access ends too?

This isn't an argument against remote access or third-party vendors.

It's an argument for knowing where that access exists and who is responsible for securing it.

A Cyberattack Can Become a Physical Problem

This may be the most important lesson from what happened in France.

Cybersecurity is often discussed in terms of data.

Someone steals information.

An account gets compromised.

Files are encrypted.

A business loses access to its systems.

But when technology controls something in the physical world, a cyberattack can have physical consequences.

In France, changing settings on refrigeration equipment didn't just affect data on a screen.

Food spoiled.

Stores had to discard inventory.

Equipment overheated.

Fires were reported.

A later wave of refrigeration attacks in Europe even affected cold-storage monitoring and control systems at three regional French blood-service facilities. Staff received alerts and moved blood products to unaffected refrigerators, preventing an impact on blood supplies.

That's a very different kind of cyber risk.

And as more physical equipment becomes connected, businesses need to think about cybersecurity beyond laptops and servers.

Start With a Simple Question: What's Connected?

You don't need to run a supermarket for this story to matter.

Look around your own business.

What equipment is connected to your network or the internet?

Which devices can be accessed remotely?

Which ones are still receiving security updates?

Are any still using default or weak credentials?

Can those devices communicate with other parts of your network?

Which vendors have remote access?

And who inside your organization is responsible for keeping track of all of it?

You may find devices your IT team already knows about.

You may also find a few surprises.

That's why maintaining an inventory of connected technology matters.

You can't protect something if you don't know it's there.

The Device an Attacker Finds May Not Be the One You're Watching

French authorities have attributed the October refrigeration attack to cyber units associated with Iran's Islamic Revolutionary Guard Corps. Iran has denied involvement.

That makes this a significant geopolitical cybersecurity story.

But I think there's a much simpler lesson for businesses.

The attackers didn't need every piece of technology in these organizations to be vulnerable.

They needed to find something connected that they could reach.

That's worth remembering the next time you're thinking about your own cybersecurity.

Don't only look at the computers.

Look at the cameras.

The thermostat.

The printer.

The door-access system.

The conference-room equipment.

The machinery.

And all the other connected devices nobody really thinks about until they stop working.

Then ask:

Which of these are connected?

Who can access them?

And when was the last time someone checked whether they're still secure?

Because sometimes the device an attacker finds isn't the one you thought you needed to protect.

Frequently Asked Questions

What connected devices can create cybersecurity risks for a business?

Almost any device that connects to a network, cloud service, or remote-management platform can introduce cybersecurity considerations. This can include security cameras, printers, thermostats, HVAC controls, access-control systems, conference-room equipment, manufacturing systems, medical equipment, refrigeration controls, and other Internet of Things (IoT) devices.

How can a business find everything connected to its network?

Start with an inventory of network-connected devices and compare it with what your IT team can see on the network. Businesses should also speak with facilities teams and outside vendors because some building systems or specialized equipment may be managed separately from traditional IT.

Are older connected devices a cybersecurity risk?

They can be. Older devices may run outdated software or firmware, contain known vulnerabilities, or no longer receive security updates from the manufacturer. A device can continue functioning operationally long after it has reached the end of its supported security life.

Should IoT and connected devices be separated from the rest of the network?

Depending on the device and environment, network segmentation can help reduce risk by limiting what a connected device can communicate with or access. The appropriate design depends on the organization's technology, operations, and security requirements.

How should businesses manage vendor remote access?

Businesses should know which vendors have remote access, what systems they can reach, how that access is authenticated, and whether the level of access is still necessary. Access should also be reviewed when vendor relationships, employees, equipment, or business requirements change.

Know What's Connected

Connected technology can make a business more efficient, easier to manage, and more responsive.

But connectivity should come with visibility.

If you're not sure what's connected to your network, who has access to it, or whether older devices may be creating unnecessary risk, Netready can help you assess your environment and identify areas that deserve attention.

Zac Abdulkadir, CISSP, CISA, CISM, CRISC
President, Netready